Plate VI. The helper
A lookinside.
The free check sees your site from the street. The helper reads the exact version of everything it runs, so Mendbird can check each one against the daily lists of known flaws.
It only reads names and versions. It answers only Mendbird, takes no instructions, and never changes anything.
Works on almost anything
Pick the one that fits your site.
WordPress
A plugin you add from your dashboard
WordPress itself, every plugin and theme with its exact version, and PHP.
Laravel
A Composer package your developer adds
PHP and its add-ons, Laravel itself, and every package the app is built from.
Other PHP sites
One file your developer uploads, for Joomla, Drupal or hand built sites
PHP and its add-ons, the site's own software, and every package it is built from.
Your own server
A small program for Linux servers
The operating system's software, the web server, PHP, Node.js and the database, and your own apps' packages in Python, Node.js, PHP, Ruby, Rust and Go.
Built from GitHub
A workflow file, for Cloudflare Workers, Vercel, Netlify and the like
Every package the site is built from, in JavaScript, PHP, Python, Ruby, Go, Rust, Java, .NET, Elixir and Dart.
Wix, Squarespace and Shopify
No helper needed
They keep their own software up to date, so the daily watch looks after your domain, padlock, email and Google.
Whichever you use, you get it from the What it runs tab in your account, made for that one site. On Laravel that is one Composer command and two lines for your .env file.
The whole list
What it reads, and what it never touches.
It reads
- The name and version of each piece of software
- Plugins and themes, and whether each is switched on
- PHP, the database and the web server
- The packages your site and apps are built from
- A few yes or no safety settings
- How many admins there are, as a number
It never touches
Posts, pages, orders or form entriesCustomer and user detailsPasswords, database details or anyone else's keysYour codeLogs, uploads or emailsAnything it could change
Mendbird checks every list it is sent, too, and drops anything that is not a name, a version or one of the agreed settings.
How it talks to Mendbird
A signed knock, once a day.
4:17am. A signed knock.
Once a day Mendbird asks the site for its list. The request carries the time and a signature made with the site's own key, and nothing else: no commands, no settings, no code.
A signed answer.
If the signature is right, the time is within five minutes and the request is new, the helper answers with its list of names and versions, signed back so Mendbird knows nothing changed on the way.
Anyone else: nothing.
Without the key, WordPress shows its normal page and the PHP file says Not found, so nobody can even tell a helper is there. The Linux and GitHub helpers go further: they send their list and listen for nothing.
What it cannot do
Built so it can't.
Not "won't": can't. There is no code in it to do any of these, which you can see for yourself.
- No commands
It takes no instructions, from Mendbird or anyone else.
- No changes
It never installs, updates or edits anything, itself included.
- No open ports
The Linux and GitHub helpers send, and listen for nothing.
- No root
Any ordinary user can run it. It needs no admin rights.
See for yourself
Don't take our word for it.
Every helper shows exactly what it sends, before it sends it.
| Kind | Name | Version | In use |
|---|---|---|---|
| WordPress | wordpress | 6.8.1 | |
| Plugin | woocommerce | 10.2.1 | Switched on |
| Plugin | contact-form-7 | 5.9.3 | Switched on |
| Theme | astra | 4.6.4 | Switched on |
| PHP | php | 8.2.18 | |
| Database | mariadb | 10.11.6 |
$ mendbird-helper --show
{"helper":{"kind":"linux","version":"1.0.0"},
"software":[
{"kind":"os","name":"debian","version":"12"},
{"kind":"deb","name":"openssl","version":"3.0.15-1~deb12u1"},
{"kind":"server","name":"nginx","version":"1.22.1"},
{"kind":"php","name":"php","version":"8.2.24"},
...],
"settings":{}}--show prints the list without sending it, and on Laravel php artisan mendbird:show does the same. On GitHub, every run prints it in the workflow's log.For your IT team
Questions people ask.
How does it know a request is really from Mendbird?
Each site has its own secret key, written into the copy of the helper you download (kept in a repository secret on GitHub, in the .env file on Laravel, and saved in the site's settings when you connect the WordPress plugin from your dashboard instead). Every message either way is signed with that key using HMAC-SHA256, over the time and a word that says what kind of message it is. A message more than five minutes out, or one already seen, is refused.
What if someone got hold of the key?
They could ask that one site for its list of versions, or send Mendbird a false one. Nothing more: the helper takes no instructions, so the key cannot make it do anything. Press Make a new key in your account and the old key stops working at once.
What happens to the list?
Mendbird keeps the latest one for the site, so the daily check can use it, and deletes it when the site is removed or the account closes. To look up flaws it sends package names and versions to public lists such as OSV, never the site's address. The list is never sold, shared, or used to train anyone's AI. The privacy notice has the rest.
Does it update itself?
No. A helper never changes itself, so what you checked is what keeps running. When there is a new version we will tell you what changed, and you choose when to install it.
Why did the GitHub helper go quiet?
GitHub pauses daily runs in repositories with no activity for 60 days. It still runs each time you push, and you can press Run workflow at any time. After three days without a list, your report says the helper has gone quiet and carries on checking from outside.
How do I stop it?
Deactivate or delete the plugin, run composer remove mendbird/helper, delete the PHP file, delete the Linux program and its cron line, or delete the workflow file. It stops at once.
Can we review it first?
Yes, please do. Each helper is short, with how it works written at the top, and the code is public at github.com/moonlathe-technologies/mendbird-helper. The Laravel package is also at github.com/moonlathe-technologies/mendbird-laravel and on Packagist as mendbird/helper. For anything else, email hello@mendbird.com.
Ready for a look inside?
The helper comes with the Watch and Agency plans. Download it from the What it runs tab of any site in your account.